Privacy notice Privacy and cookies

Who handles your data

The data controller is:

Grippo Rosellina (trading as Trattoria dal Vecchio Scarpone)
Business premises: Corso Vittorio Emanuele 3
85010 Castelmezzano (PZ), Italy
VAT no. 01035490760
Phone +39 333 732 5640 · Email santoroa37@gmail.com

What data we collect

For visitors there are no forms and no sign-up, and we use no analytics or advertising tools. The only form is the staff area login, used only by the manager.

• Browsing data. The server hosting the site automatically logs some technical data: IP address, browser type, requested page, date and time. The same applies to the automatic check the menu page makes on our own site every 20 seconds, to show you the updated menu straight away. It is used to run the site and protect it from abuse.
• Staff area. It is for the manager only, who signs in with email and password. To protect it, the site counts failed sign-in attempts per IP address and blocks anyone who makes too many for 15 minutes. The hosting provider's firewall limits too-frequent sign-in requests from the same address.
• Data you give us. If you call or write to us, we use your name, phone number, email and what you tell us only to reply and manage your table or room booking. For guests staying with us we also collect the identity document details of each guest, as the law requires.

Why, and on what legal basis

• Replying to your requests and managing bookings: steps prior to a contract, or a contract (Art. 6(1)(b) GDPR).
• Registering guests staying in the rooms and reporting them to the police (Art. 109 TULPS), and keeping tax records: legal obligations (Art. 6(1)(c) GDPR).
• Browsing data and staff area protection (attempt counting, firewall limits): our legitimate interest in running the site and keeping it secure (Art. 6(1)(f) GDPR).

If you do not give us the data

Giving us your data is optional, but without it we cannot manage your booking. For the rooms, guest details are required by law. We make no automated decisions and do no profiling.

How long we keep it

Request and booking data for as long as needed to handle them, unless the law requires otherwise (accounting records are kept for 10 years). Guest data for the rooms for the periods set by law. Failed sign-in attempt counts are deleted after 15 minutes. Staff area cookies expire as shown below. Server logs are kept for the short period set by the hosting provider (currently one day at most).

Who receives the data

The site is hosted by Vercel Inc. (United States), which receives browsing data. Vercel is certified under the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission (Art. 45 GDPR): you can ask us for a copy of the safeguards at the email above. The menu and the manager's account are kept by Supabase Inc. on servers in Frankfurt: no visitor data is stored there. Emails you send us arrive in a Gmail (Google) inbox. For guests of the rooms, data goes to the police through the Alloggiati Web portal when the law requires it. Where applicable, our accountant and the tax authorities receive the data needed for legal obligations. We do not sell or pass on your data to anyone else.

Cookie

We use no cookies or similar technologies for visitors, for profiling or for statistics. Fonts and images are on our own server, so your browser contacts no outside services while you browse.

Only the staff area, used by the manager, sets two technical first-party cookies, needed to stay signed in:

• __Host-accesso: keeps the session open and lasts one hour at most.
• __Host-rinnovo: renews the session without asking for the password again and expires 12 hours after last use.

Both are deleted on sign-out. Technical cookies need no consent by law, which is why there is no cookie banner.

Links to other sites

Instagram, Facebook, Tripadvisor, Google and Google Maps are plain links: no data is sent until you open them. From then on, those sites' privacy policies apply.

Your rights

You can ask to access, correct or delete your data, restrict its processing, receive it in a portable format or object to its processing (Arts. 15-22 GDPR). Write to santoroa37@gmail.com. You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.